aol.pm

Deep Panda

IntrusionSet · ATTACK:enterprise:G0009

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:enterprise:G0009",
  "title": "Deep Panda",
  "type": "IntrusionSet",
  "source_url": "https://attack.mitre.org/groups/G0009",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "intrusion-set--a653431d-6a5e-4600-8ad3-609b5af57064",
  "external_id": "G0009",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:49.412Z",
  "modified": "2026-07-31T18:48:11.915Z",
  "version": "1.2",
  "aliases": [
    "Deep Panda",
    "Shell Crew",
    "WebMasters",
    "KungFu Kittens",
    "PinkPanther",
    "Black Vine"
  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "Deep Panda"
    },
    {
      "source_name": "Shell Crew"
    },
    {
      "source_name": "WebMasters"
    },
    {
      "source_name": "KungFu Kittens"
    },
    {
      "source_name": "PinkPanther"
    },
    {
      "source_name": "Black Vine"
    },
    {
      "source_name": "Alperovitch 2014",
      "url": "https://web.archive.org/web/20200424075623/https:/www.crowdstrike.com/blog/deep-thought-chinese-targeting-national-security-think-tanks/"
    },
    {
      "source_name": "Symantec Black Vine",
      "url": "https://web.archive.org/web/20170823094836/http:/www.symantec.com/content/en/us/enterprise/media/security_response/whitepapers/the-black-vine-cyberespionage-group.pdf"
    },
    {
      "source_name": "RSA Shell Crew",
      "url": "https://www.rsa.com/content/dam/en/white-paper/rsa-incident-response-emerging-threat-profile-shell-crew.pdf"
    },
    {
      "source_name": "ICIT China's Espionage Jul 2016",
      "url": "https://web.archive.org/web/20171017072306/https://icitech.org/icit-brief-chinas-espionage-dynasty-economic-death-by-a-thousand-cuts/"
    },
    {
      "source_name": "ThreatConnect Anthem",
      "url": "https://www.threatconnect.com/the-anthem-hack-all-roads-lead-to-china/"
    }
  ]
}

Explicit source assertions (17)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fbf92c8-747b-4c0f-ab33-ce63cbff8197

Alperovitch 2014

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:S0080

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--235fe6f1-66d1-4cf4-adb9-3bc7f081144a

Symantec Black Vine

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1018

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--280bb6ec-0d7f-4a42-a3f2-7a3b43886126

Alperovitch 2014

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:S0097

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2ce2f87e-527d-4bc1-9ba1-79ade0a4db59

Alperovitch 2014

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:S0039

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2df910df-37cc-4349-96c3-f938fa5a9054

Alperovitch 2014

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1505.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--44f230bb-b59a-4f30-8203-5e5ffd9796f5

CrowdStrike Deep Panda Web Shells

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1027.005

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d68b3eb-9689-4a6d-b6ab-367fbc5ddade

Symantec Black Vine

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1218.010

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4fab8d06-e6fb-472f-91ee-f2fd29ef444e

RSA Shell Crew

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:S0142

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66a3ab46-abcb-4234-a786-638044cfc50e

Cylance Shell Crew Feb 2017

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1564.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--673bf715-0ccc-48fd-93b5-570b417cc41a

Alperovitch 2014

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1059.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fdc3210-9754-4157-b386-8fcd680e732c

Alperovitch 2014

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:S0074

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70dc6b5c-c524-429e-a6ab-0dd40f0482c1

ThreatConnect Anthem

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:S0057

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9d081347-3446-47a4-b5a9-d7a9d2d499e7

Alperovitch 2014

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1546.008

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ab069468-3dff-4c77-9293-adb0b2627a4e

RSA Shell Crew

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:S0021

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba4e03d1-f9b6-442d-974b-2fb7feddb551

ThreatConnect Anthem

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1047

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d295beee-439c-44f9-9908-4cb194331de9

Alperovitch 2014

ATTACK:enterprise:G0009 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f43ab4db-5dea-4a1f-977a-f5d779330193

Alperovitch 2014

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.